BerriAI/litellm · error · HTTPException

🚨🚨🚨 DISABLING ADMIN ENDPOINTS is an Enterprise feature 🚨

Error message

🚨🚨🚨 DISABLING ADMIN ENDPOINTS is an Enterprise feature
🚨 You must be a LiteLLM Enterprise user to use this feature. If you have a license please set `LITELLM_LICENSE` in your env. Get a 7 day trial key here: https://www.litellm.ai/enterprise#trial. 
Pricing: https://www.litellm.ai/#pricing

What it means

HTTP 500 raised by EnterpriseRouteChecks.is_management_routes_disabled: DISABLE_ADMIN_ENDPOINTS is present in the environment but premium_user is False. Like the LLM-route variant, disabling admin endpoints is enterprise-gated, so an unlicensed proxy that sets the env var fails the check.

Source

Thrown at enterprise/litellm_enterprise/proxy/auth/route_checks.py:37

                raise HTTPException(
                    status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
                    detail=f"🚨🚨🚨 DISABLING LLM API ENDPOINTS is an Enterprise feature\n🚨 {CommonProxyErrors.not_premium_user.value}",
                )

        return get_secret_bool("DISABLE_LLM_API_ENDPOINTS") is True

    @staticmethod
    def is_management_routes_disabled() -> bool:
        """
        Check if management route is disabled
        """
        from litellm.proxy._types import CommonProxyErrors
        from litellm.proxy.proxy_server import premium_user
        from litellm.secret_managers.main import get_secret_bool

        if "DISABLE_ADMIN_ENDPOINTS" in os.environ:
            if not premium_user:
                raise HTTPException(
                    status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
                    detail=f"🚨🚨🚨 DISABLING ADMIN ENDPOINTS is an Enterprise feature\n🚨 {CommonProxyErrors.not_premium_user.value}",
                )

        return get_secret_bool("DISABLE_ADMIN_ENDPOINTS") is True

    # Routes that should remain accessible even when LLM API endpoints are disabled.
    # These are read-only model listing routes needed by the Admin UI.
    LLM_API_EXEMPT_ROUTES = ["/models", "/v1/models"]

    @staticmethod
    def should_call_route(route: str):
        """
        Check if management route is disabled and raise exception
        """
        from litellm.proxy.auth.route_checks import RouteChecks

        if (

View on GitHub (pinned to 6c2dcb801b)

Solutions

Unset DISABLE_ADMIN_ENDPOINTS if unlicensed and protect admin routes with network rules or master-key discipline
Alternatively provide a valid LITELLM_LICENSE to legitimately enable the feature
Sweep env/compose/systemd definitions for enterprise-only variables when running OSS

Example fix

# before (docker-compose.yml)
environment:
  - DISABLE_ADMIN_ENDPOINTS=true
# no license -> 500

# after
environment: []
# plus firewall/ingress rules blocking /manage/* paths

Defensive patterns

Strategy: validation

Validate before calling

assert not (os.environ.get('DISABLE_ADMIN_ENDPOINTS') and not os.environ.get('LITELLM_LICENSE')), \
    'DISABLE_ADMIN_ENDPOINTS requires an enterprise license'

Try / catch

resp = httpx.get(f'{PROXY_URL}/health', headers=h)
if resp.status_code == 500 and 'DISABLING ADMIN ENDPOINTS' in resp.text:
    fail_deploy('unset DISABLE_ADMIN_ENDPOINTS or add license')

Prevention

CI check: fail builds where enterprise env vars exist without a license secret
Document which env vars are enterprise-gated next to the compose file

When it happens

Trigger: Setting DISABLE_ADMIN_ENDPOINTS=true (any value; mere presence triggers the premium check) on a proxy without a valid license, then issuing any request whose route checks consult this function.

Common situations: Trying to hide admin endpoints on OSS; migrating a licensed deployment to OSS and leaving DISABLE_ADMIN_ENDPOINTS in the compose file; CI/test environments copying enterprise env templates.

Related errors

AI-assisted analysis of BerriAI/litellm@6c2dcb801b (2026-08-15). Data as JSON: /api/errors/11074723ba3d7faf. Report an issue: GitHub.